LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50146: PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors

In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors If dw_pcie_ep_init() fails to perform any action after the EPC memory is initialized and the MSI memory region is allocated, the latter parts won't be undone thus causing a memory leak. Add a cleanup-on-error path to fix these leaks. [bhelgaas: commit log]

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue is a memory leak in PCI DWC endpoint initialization. If initialization fails after endpoint-controller and MSI memory are allocated, cleanup did not fully run. The available sources do not provide CVSS, CWE, or evidence of active exploitation.

Executive priority

Treat this as routine kernel hygiene unless affected PCI endpoint systems are business-critical or unstable. There is no cited active exploitation, but unpatched memory leaks can degrade reliability on exposed hardware paths.

Technical view

CVE-2022-50146 affects Linux PCI DWC endpoint code in dw_pcie_ep_init(). Failure paths after EPC initialization and MSI allocation could leave memory allocated. Kernel stable commits add cleanup-on-error handling to deallocate the EPC/MSI-related memory.

Likely exposure

Exposure is most likely on systems running affected Linux kernel versions with PCI DWC endpoint functionality present. The bundle lists Linux as affected, including versions around 4.16 and fixed stable releases such as 5.10.137, 5.15.61, 5.18.18, 5.19.2, and 6.0.

Exploitation context

The source bundle marks KEV as false and provides no public exploitation evidence. The impact described is a kernel memory leak on initialization failure, not code execution or privilege escalation. Practical risk depends on whether the affected driver path is reachable on deployed hardware.

Researcher notes

Evidence is limited to the CVE record and Linux stable commits. No CVSS, CWE, exploit status, or detailed affected-hardware matrix is provided. Validate reachability through kernel configuration, platform hardware, and downstream patch status.

Mitigation direction

  • Update to a vendor-supported kernel containing the referenced stable fix.
  • Map distribution kernel packages to the cited upstream stable commits.
  • Prioritize systems using PCI DWC endpoint functionality or embedded PCIe endpoint hardware.
  • If update timing is unclear, monitor vendor advisories for backported fixes.

Validation and detection

  • Inventory running kernel versions across Linux assets.
  • Check whether PCI DWC endpoint functionality is enabled or relevant on each platform.
  • Confirm the applicable stable commit or downstream backport is present.
  • Review kernel or vendor advisories for affected-version mapping.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50146 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux2fd0c9d966cc11bb5f73556dd788d12f501d8755, 2fd0c9d966cc11bb5f73556dd788d12f501d8755, 2fd0c9d966cc11bb5f73556dd788d12f501d8755, 2fd0c9d966cc11bb5f73556dd788d12f501d8755, 2fd0c9d966cc11bb5f73556dd788d12f501d8755unaffected
LinuxLinux4.16, 0, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.